CVE-2024-38266

An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware versions through 5.50ABOM.8C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread...

PT-2024-39403 · WordPress · The Oneelements – Best Elementor Addons

Name of the Vulnerable Software and Affected Versions: The OneElements – Best Elementor Addons plugin for WordPress versions up to, and including, 1.3.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping...

PT-2024-39218 · WordPress · Beam Me Up Scotty – Back To Top Button

Name of the Vulnerable Software and Affected Versions: Beam me up Scotty – Back to Top Button plugin for WordPress versions up to, and including, 1.0.21 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on the URL. This...

PT-2024-7541 · Unknown · Workstation

Name of the Vulnerable Software and Affected Versions: WorkstationST affected versions not specified Description: The issue is related to incorrect restriction of the directory path name in the OPC server. Exploitation of this issue may allow a remote attacker to gain access to the server...

PT-2024-31671 · Zimbra · Zimbra Collaboration +2

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions through 10.0 Description: A stored Cross-Site Scripting XSS attack is possible due to improper sanitization of user input in Zimbra Webmail Modern UI. This allows an attacker to inject malicious code into...

PT-2024-9227 · 2N · 2N Access Commander

Name of the Vulnerable Software and Affected Versions: 2N Access Commander versions 3.1.1.2 and prior Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow a remote attacker to execute arbitrary code. This can be...

The vulnerability of the functional web frameworks WebMvc.fn and WebFlux.fn of the Spring Framework arises from incorrect path name restrictions for restricted directories. This allows attackers to gain access to any file in the file system.

The vulnerability of the functional web frameworks WebMvc.fn and WebFlux.fn of the Spring Framework is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to any file in t...

PT-2024-39160 · WordPress · Koko Analytics

Name of the Vulnerable Software and Affected Versions: Koko Analytics plugin for WordPress versions prior to 1.3.13 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts in pages. This can...

PT-2024-32329 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.1 Description: The issue allows an attacker to achieve remote command execution by adding a carefully constructed h2 data source connection string. This can be done by sending a POST request to the...

PT-2024-32086 · Helpdesk · Helpdesk

Name of the Vulnerable Software and Affected Versions: HelpDeskZ version 2.0.2 Description: A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box. This issue potential...

PT-2024-38900 · WordPress · The Radio Player – Live Shoutcast

Name of the Vulnerable Software and Affected Versions: The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin versions up to, and including, 2.0.78 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and outp...

PT-2024-32298 · Mellium · Mellium.Im/Xmpp

Name of the Vulnerable Software and Affected Versions: Mellium mellium.im/xmpp versions 0.0.1 through 0.21.4 Description: The issue allows response spoofing because the stanza type is not checked. This can lead to potential system compromise. The estimated number of potentially affected devices...

ROS-20240923-02

Vulnerability of ANGLE library in Mozilla Firefox, Firefox ESR and Thunderbird email client browsers is related to writing beyond buffer boundaries. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service. remotely to cause a denial of service...

PT-2024-39416

Name of the Vulnerable Software and Affected Versions SourceCodester Online Eyewear Shop version 1.0 Description A critical issue affects some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the type argument with the input 1 leads to...

PT-2024-39412 · Unknown · Code-Projects Student Record System

Name of the Vulnerable Software and Affected Versions: code-projects Student Record System version 1.0 Description: A critical issue has been found in the code-projects Student Record System, affecting unknown code in the file /course.php. The manipulation of the coursename argument leads to SQL...

CVE-2024-8853

Vulnerability summary (CVE-2024-8853) The Webo-facto plugin for WordPress is affected in versions up to and including 1.40. The root cause is an insufficient restriction on the doSsoAuthentification function, enabling unauthenticated attackers to escalate privileges by registering with a username...

PT-2024-31774

Name of the Vulnerable Software and Affected Versions: Confidant versions prior to 6.6.2 Description: The issue is a cross-site scripting XSS vulnerability that affects various API endpoints in Confidant, an open-source secret management service. These endpoints include GET /v1/credentials, GET...

PT-2024-29883 · Galaxy · Galaxy

Name of the Vulnerable Software and Affected Versions: Galaxy versions prior to the latest patched version Description: The issue concerns the editor visualization, specifically the "/visualizations" endpoint, which can be used to store HTML tags and trigger javascript execution upon an edit...

WordPress plugin Webo-facto 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

VulnCheck KEV: CVE-2017-11511

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...